diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index bb49a8f..f4ee9f2 100644
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -1303,8 +1303,9 @@ sub file_upload_multipart {
 
         my $extract_form_disposition = sub {
             my ($name) = @_;
+            # parameter values can be a token or a quoted-string, see RFC 7578, section 4.2
             if ($hdl->{rbuf} =~
-                s/^${delim_re}.*?Content-Disposition: (.*?); name="$name"(.*?${delim_re})/$2/s
+                s/^${delim_re}.*?Content-Disposition: (.*?); name=(?:"\Q$name\E"|\Q$name\E(?=[;\s]))(.*?${delim_re})/$2/s
             ) {
                 assert_form_disposition($1);
                 $remove_until_data->($hdl);
@@ -1319,13 +1320,14 @@ sub file_upload_multipart {
             $extract_form_disposition->('checksum');
 
             if ($hdl->{rbuf} =~
-                s/^${delim_re}Content-Disposition: (.*?); name="(.*?)"; filename="([^"]+)"//s
+                s/^${delim_re}Content-Disposition: (.*?); name=(?:"(.*?)"|([^\s;"]+)); filename=(?:"([^"]+)"|([^\s;"]+))//s
             ) {
-                assert_form_disposition($1);
-                die "wrong field name '$2' for file upload, expected 'filename'"
-                    if $2 ne "filename";
+                my ($disposition, $field, $filename) = ($1, $2 // $3, $4 // $5);
+                assert_form_disposition($disposition);
+                die "wrong field name '$field' for file upload, expected 'filename'"
+                    if $field ne "filename";
                 $rstate->{phase} = 2;
-                $rstate->{params}->{filename} = trim($3);
+                $rstate->{params}->{filename} = trim($filename);
                 $remove_until_data->($hdl); # any remaining multipart "headers" like Content-Type
             }
         }